Information Management Assessment

Action plan progress review

Department for Communities and Local Government

Reviewed February 2015

Published August 2015

Working with government to raise standards in information management **Background**

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Department for Communities and Local Government (DCLG) IMA took place in 2012. Interviews were conducted at the Department’s London offices between 12 and 19 March. DCLG produced a detailed action plan and progress against this was formally assessed via meetings held in August 2014 and February 2015. The IMA report and action plan are both published on The National Archives website.¹

This progress review summarises key developments since the 2012 IMA. Areas where continued attention is still needed are listed below under ‘Next Steps’.

**Progress to address recommendations and risk areas**

The 2012 IMA report rated DCLG’s performance as ‘Satisfactory’ against 8 headings on the IMA performance framework risk matrix and ‘Good’ against 1 heading. It identified 11 ‘Development Needed’ areas and made 15 recommendations for improvement. Particular attention was paid to the following considerations:

**Strategic direction**

| Situation at the time of the IMA | |----------------------------------| | Annual work plans were being produced by the Corporate Records Management Services team, but there was limited evidence that long-term, DCLG-wide goals were being established for the information the Department held and for which it has responsibility. |

An Electronic Records Handling Strategy is now in place. This was jointly approved by the Departmental Records Officer (DRO) and Chief Information Officer (CIO) in 2014. The strategy covers information held in shared and personal drives, mailboxes and the Department’s near-line electronic records repository, VISIONS.

¹ [http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/](http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/) A separate Knowledge Management Strategy was drafted in early 2014. This document is intended as the successor to the previous 2008 DCLG Knowledge Management Strategy. It was agreed by the Senior Information Risk Owner (SIRO) in December 2014. This gives DCLG a set of high-level endorsed strategic aims and outcomes above the level of the Electronic Records Handling Strategy, towards which work by KIM, IT and information assurance teams can be aligned. This makes it easier for DCLG to achieve co-ordinated improvements in the management, protection and exploitation of its information. It also means that the Electronic Records Handling Strategy can be positioned as a key enabler of the overall Knowledge Management Strategy.

**Resources, planning and transition to the 20-year rule**

| Situation at the time of the IMA | |----------------------------------| | Corporate Records Management Services staff were predominantly engaged in “fire fighting” and were not engaged in proactive activities. The IMA report noted the potential additional impact that transition to the 20-Year rule could have on the service they provided. |

Corporate Records Management Services was rebranded as Records and Information Governance Services in 2013. The team continues to provide shared services, which will necessarily have some impact on time and resources available to oversee DCLG’s own records. The team has also undergone resource cuts since the IMA. Nonetheless, we recognise that the team is currently planning and working in a more structured manner than at the time of the IMA. It is also engaging more actively with individual business units. This includes the provision of tailored advice on retention to staff working with particularly sensitive or high-value information.

DCLG has a 20-year rule implementation plan that covers its own records and the shared service arrangements it provides for other organisations. The plan provides detailed context on review progression up to 2003 and overall progress against 20-year rule targets. It highlights events with potential historic significance in scope of the transition period. We understand that progress against the plan has been a major focus for the monthly meetings DCLG set up with The National Archives following the IMA. These meetings have provided the opportunity to interrogate progress and understand the volume and transfer status of the records in more detail.

**Records creation, staff understanding and management controls**

| Situation at the time of the IMA | |----------------------------------| | Shared drives and Approved File Plans were not subject to central control. Email accounts with large capacities and personal drives with unlimited capacities provided staff with alternative locations where information could be held. Without a signed-off records management policy, there was no mandate and there was little monitoring to assess how staff were managing information in practice. |

DCLG has now produced a concise and straightforward, corporately branded record retention and disposal policy, and a linked policy on deletion processes. The publication of the former is a crucial first step in ensuring staff can understand what is expected of them. DCLG further supported this through work carried out to review and simplify the records management pages on the intranet.

DCLG has also, in liaison with The National Archives, drafted an electronic review and transfer policy document. DCLG is seeking to refine the policy and establish a small pilot project in order to identify and address the difficulties in reviewing large quantities of electronic and hybrid material. DCLG is a member of The National Archives’ Digital Working Group and is seeking further guidance through this route.

At the time of the IMA we noted the lack of a single corporate repository as a concern. There is still no corporate filing plan in place. However, DCLG did include a request for a collaboration tool and email management system in its 2014 IT re-let, through which SharePoint 2010 and E-Vault were acquired.

We recognise that work has been carried out since the IMA to influence behaviours including challenging individuals who were judged to be holding significant volumes of information outside corporate repositories. Processes were also put in place to monitor mailbox sizes and escalate concerns to the CIO and SIRO. Monitoring activities are currently being carried out on an ad-hoc basis in advance of the introduction of SharePoint 2010 and E-Vault. While a driver for this work has been removed by a reduction in pressures on corporate storage capacity, the potential impact of personal storage on information availability remains the same. DCLG should re-energise monitoring activities as the new IT environment is put in place. This is because of the new behaviours and ways of working that will be required and the potential influence these may have on the information and records management-related risks the department faces.

Digital continuity and change management

| Situation at the time of the IMA | |----------------------------------| | There was limited opportunity for formal communication between knowledge and information management and IT staff. Access to the shared drives was controlled by a third-party IT supplier. DCLG had little oversight of the digital information in its shared drives and lacked a formal digital continuity plan. It needed to ensure information requirements were central to IT change. |

An IT liaison role has now been established. In practical terms, a lack of access to the shared drives continues to be a barrier to oversight of digital information by the KIM team. This makes it harder to ensure digital information will remain complete, available and usable and harder to ensure legal requirements and business needs can be met. The Records and Information Governance Services Team has, however, been working to overcome permissions related issues to gain access and has undertaken work to identify the areas of its shared drives that contain active and non-active information. It plans to build on this work, allocating ownership to information held and identifying and taking responsibility for any information that has been orphaned by structural changes.

The discovery phase of assessing the capabilities of SharePoint finished in April 2015. DCLG developed functional requirements for SharePoint and for E-Vault, which contain a number of positive elements including outcomes for metadata generation, maintenance and migration. SharePoint 2010 does not by itself support records management or email integration and DCLG has no plans to procure third party software modules to deliver either of these. DCLG is instead investigating the use of customised scripting to enable activities such as email transfer. The Department recognises the risks that overcustomisation can bring.

Because DCLG is planning to use SharePoint as a repository for records, the new system needs to support the Department to meet its obligations for their safekeeping and transfer. From a records management point of view and from a business point of view the new system also needs to support effective email integration. Without this there is a risk that email will be excluded from the Department’s records. For example, while it is positive in principle that a requirement has been identified for automated disposal within E-Vault, this will in practice increase the threat that DCLG loses information with value if staff cannot move important emails to corporate repositories. Current investigations are intended to identify solutions to these issues. Getting this right will be crucial to ensuring the new system can deliver required outcomes.

**Information Risks and Information Security**

| Situation at the time of the IMA | |----------------------------------| | The lack of strategy and clear goals for information undermined the Department’s ability to identify the information risks it faced. Risk descriptions focused on IT considerations and we gained no assurance that impacts relating to information and records management were defined or subject to senior scrutiny. The department gained a ‘development needed’ rating for security in the 2012 IMA report due to a lack of controls to prohibit the use of unencrypted pen drives to transfer data off the network. |

In practical terms, we are pleased to recognise that DCLG now has a solution in place to manage which USB devices can be connected to the Department’s desktops. We also recognise that the Records and Information Governance Services team has defined a range of information and records management-related risks since 2012. These include risks that relate to a number of problem areas. highlighted in the Department’s IMA report, such as adoption and use of Accredited File Plans and storage of corporate records in email and personal drives. DCLG states that records and information management related risks feature on the directorate risk register and have featured on the departmental security risk register where necessary. We understand that the DRO also attends the Information Risk Advisory Board and also liaises regularly with the SIRO.

DCLG reviewed its information assurance and risk policy in July 2014 and again following the IMA progress review as part of a wider guidance refresh. We note that the policy now includes reference to the Public Records Act. While this is positive in itself, the document does not, however, define the risk of not capturing or keeping the information DCLG needs, how this risk will be managed or how the effectiveness of DCLG’s approach will be assessed. DCLG has also defined its appetite in relation to information risk. This work represents positive progress, but we note that the risk appetite statement does not explicitly reference information and records management-related risk. Further work in this area is needed to build on the start DCLG has made.

**Networks and training**

| Situation at the time of the IMA | |----------------------------------| | DCLG did not have an active, centrally-directed network of information support staff. A re-energised Business Records Officers (BRO) network would provide a means to promote good practice and encourage adherence to information and records management principles |

At the time of our February 2015 progress review meeting, DCLG had not yet been able to resurrect the BRO network. We understand that it has now done so. Having an active and complete network will help DCLG to enable good information and records management within the current technology environment and when new systems are introduced.

Although a fully operational network was not in place to support dissemination of good-practice guidance and drive compliance, DCLG estimates that nearly 140 knowledge and information management-related training events have been conducted since the IMA. These include specific training delivered to individual divisions and within regional offices and to audiences including Information Asset Owners and senior service staff. Across March and April of 2015, DCLG conducted 10 workshops for staff to prepare for the eventual roll out of SharePoint 2010. DCLG is also seeking to ensure that all members of their Records and Information Governance Service have some form of qualification in Records/Information Management. Two members of staff have received certificates from the University of Liverpool, whilst another is due to start the same course in September. Other members of staff will be certified by relevant KIM bodies.

**Knowledge management**

| Situation at the time of the IMA | |----------------------------------| | DCLG had not defined in corporate terms what it meant by knowledge and without a signed off strategy was not setting clear goals. |

Adoption of the DCLG Knowledge Management strategy provides a basis to take this work forward. As the Department seeks to embrace new opportunities for sharing and exploiting information offered by the introduction of new IT systems, ensuring clarity in this area becomes more important than ever. Next steps

The National Archives will continue to work closely with DCLG so that the Department is supported as it continues its work on information and records management. It is recommended that DCLG focuses on the following:

- Implementation of the DCLG Knowledge Management Strategy against defined milestones. This now needs to provide direction for Records and Information Governance Services, IT and IA staff together.
- Ensuring that information and records management related risks can receive the right level of scrutiny and visibility as new systems such as SharePoint and E-Vault are introduced so their impact on information and records management objectives can be understood. DCLG should refer to guidance on information risk policies published in support of the Security Policy Framework and ensure that its own information assurance and risk policy provides a clear definition of information and records management-related risk, and clearly sets out the approach to managing it.²
- Getting the right solutions in place to support email integration and records management. This will be crucial to enabling hoped for business benefits including increased opportunities for collaborative working and improved ability to meet legal obligations. If the ability to dispose of and transfer records in a controlled manner and according to agreed policy is not enabled through SharePoint, then these outcomes will have to be achieved through other means. DCLG needs to ensure there is ongoing senior backing to work to provide a more supportive technology environment.
- Embedding a working, centrally-led network to help promote good practice principles and drive necessary improvements in culture.
- Identifying criteria for good practice in information and records management once new systems are introduced and ensuring metrics are in place to monitor performance against them.
- Continuing to liaise with The National Archives on: the planned P-drive strategy; plans for information held in the shared drives; and for digital appraisal, disposal and transfer; and digital continuity planning more widely.

² https://www.gov.uk/government/collections/government-security Following publication of this review, The National Archives will work closely with DCLG to address remaining issues via regular meetings with the Department's Information Management Consultant (IMC). Areas highlighted in the Next Steps section will be reviewed at the time of the Department's IMA reassessment.

**IMA risk matrix**

| Governance and leadership | Assessed 2011 | Reviewed 2014 | |---------------------------|--------------|--------------| | Strategic management | | | | Business objectives | | | | Management controls | | | | Resourcing | | | | Risk management | | |

**Records management**

| Records management | Assessed 2011 | Reviewed 2014 | |--------------------|--------------|--------------| | Creation | | | | Storage | | | | Appraisal, disposal and transfer | | | | Management | | | | Digital continuity | | | | Access to information | | | |-------------------------------|---|---| | FOI/Data protection | | | | Re-use | | | | Security | | |

| Compliance | | | |-------------------------------|---|---| | Staff responsibilities and delegations | | | | Policies and guidance | | | | Training | | | | Change management | | |

| Culture | | | |-------------------------------|---|---| | Commitment | | | | Staff understanding | | | | Knowledge management | | |

| Key to colour coding | | | |-------------------------------|---|---| | Best Practice | | | | Category | |--------------------------| | Good | | Satisfactory | | Development needed | | Priority attention area |